Web Artifact Analysis

Autopsy is configured to search for common web artifacts from today's major browsers, including:

Firefox

Chrome

Internet Explorer

Autopsy extracts the following information and posts it to the blackboard:

Bookmarks

Cookies

History

Downloads

Search queries

To make it easier to find this data, results from all browsers are merged together. So, if you want to see the user's history, go to the history node. You don't need to go through folders for different browsers before you can find the history.

These are all categorized and displayed automatically in the Autopsy tree view under the 'Results' node. This feature gives an investigator automated quick access to the application level details of what a user was doing via web browsers and could lead to additional keyword search queries and investigation hypothesis to explore.